Commit graph

16705 commits

Author SHA1 Message Date
Tim Wojtulewicz
b76096a9ee Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot

(cherry picked from commit 4c0c7581c8)
2024-07-26 10:18:47 -07:00
Tim Wojtulewicz
b9e4669632 Updating CHANGES and VERSION. 2024-07-25 11:06:51 -07:00
Tim Wojtulewicz
5974613cae Generate docs for 7.0.0-rc3 2024-07-25 10:52:29 -07:00
Christian Kreibich
3a44bda957 Bump zeek-testing-cluster to reflect deprecation of prometheus.zeek
(cherry picked from commit 146cf99ff6)
2024-07-24 17:07:14 -07:00
Christian Kreibich
51262d02c7 Merge branch 'topic/christian/ack-contribs' into release/7.0
* topic/christian/ack-contribs:
  Add contributors to 7.0.0 NEWS entry [skip ci]
2024-07-24 17:01:39 -07:00
Christian Kreibich
b46aeefbab Add contributors to 7.0.0 NEWS entry [skip ci] 2024-07-24 16:48:17 -07:00
Tim Wojtulewicz
a4b746e5e8 Merge remote-tracking branch 'origin/topic/timw/smb2-ioctl-errors'
* origin/topic/timw/smb2-ioctl-errors:
  Update 7.0 NEWS with blurb about multi-PDU parsing causing increased load [nomail] [skip ci]
  Fix handling of zero-length SMB2 error responses

(cherry picked from commit bd208f4c54)
2024-07-24 13:29:09 -07:00
Tim Wojtulewicz
746ae4d2cc Merge remote-tracking branch 'origin/topic/johanna/update-the-ct-list-and-the-ca-list-again'
* origin/topic/johanna/update-the-ct-list-and-the-ca-list-again:
  Update Mozilla CA list and CT list

(cherry picked from commit cb88f6316c)
2024-07-23 08:55:11 -07:00
Tim Wojtulewicz
a65a339aa8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot

(cherry picked from commit da7c3d9138)
2024-07-23 08:52:47 -07:00
Arne Welzel
8014c4b8c3 telemetry: Deprecate prometheus.zeek policy script
With Cluster::Node$metrics_port being optional, there's not really
a need for the extra script. New rule, if a metrics_port is set, the
node will attempt to listen on it.

Users can still redef Telemetry::metrics_port *after*
base/frameworks/telemetry was loaded to change the port defined
in cluster-layout.zeek.

(cherry picked from commit bf9704f339)
2024-07-23 10:05:46 +02:00
Tim Wojtulewicz
d9dc121e9a Update broker submodule [nomail] 2024-07-22 15:00:22 -07:00
Tim Wojtulewicz
5a56ff92d2 Updating CHANGES and VERSION. 2024-07-18 14:54:47 -07:00
Tim Wojtulewicz
b13dfa3b16 Update docs submodule [nomail] 2024-07-18 14:31:49 -07:00
Christian Kreibich
d17a1f9822 Bump zeek-testing-cluster to pull in tee SIGPIPE fix
(cherry picked from commit b51a46f94d)
2024-07-17 15:39:45 -07:00
Tim Wojtulewicz
5cdddd92d5 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot

(cherry picked from commit 9ba7c2ddaf)
2024-07-16 10:16:57 -07:00
Tim Wojtulewicz
b8d11f4688 CI: Set FETCH_CONTENT_FULLY_DISCONNECTED flag for configure 2024-07-12 16:13:11 -07:00
Tim Wojtulewicz
91b23a6e2e Update broker and cmake submodules [nomail] 2024-07-12 16:13:04 -07:00
Tim Wojtulewicz
a8c56c1f25 Fix a broken merge
I merged an old version of the branch on accident and then merged the right
one over top of it, but git ended up including both versions. This fixes
that mistake.

(cherry picked from commit f3bcf1a55d)
2024-07-12 10:04:16 -07:00
Tim Wojtulewicz
5f6df68463 Merge remote-tracking branch 'origin/topic/bbannier/lib-spicy-hooks'
* origin/topic/bbannier/lib-spicy-hooks:
  Do not emit hook files for builtin modules

(cherry picked from commit b935d2f59a)
2024-07-12 09:52:44 -07:00
Tim Wojtulewicz
ac95484382 Merge remote-tracking branch 'origin/topic/bbannier/lib-spicy-hooks'
* origin/topic/bbannier/lib-spicy-hooks:
  Do not emit hook files for builtin modules

(cherry picked from commit 7a38cee81f)
2024-07-12 09:48:40 -07:00
Tim Wojtulewicz
962b03a431 Merge remote-tracking branch 'origin/topic/timw/grealpath-make-dist-warning'
* origin/topic/timw/grealpath-make-dist-warning:
  Fix warning about grealpath when running 'make dist' on Linux

(cherry picked from commit e4716b6c91)
2024-07-12 09:47:38 -07:00
Tim Wojtulewicz
92a685df50 Fix a typo in the 7.0 NEWS 2024-07-11 14:20:47 -07:00
Tim Wojtulewicz
1bf439cd58 Updating CHANGES and VERSION. 2024-07-11 13:20:24 -07:00
Tim Wojtulewicz
f124b31904 Updating submodule(s) [nomail] 2024-07-11 12:21:02 -07:00
Christian Kreibich
c4bc9078ef Merge branch 'topic/christian/broker-prometheus-cpp'
* topic/christian/broker-prometheus-cpp:
  Update the scripts.base.frameworks.telemetry.internal-metrics test
  Revert "Temporarily disable the scripts/base/frameworks/telemetry/internal-metrics btest"
  Bump Broker to pull in new Prometheus support and pass in Zeek's registry
2024-07-11 12:15:16 -07:00
Christian Kreibich
77816f9a6b Update the scripts.base.frameworks.telemetry.internal-metrics test
This now uses different record fields, and for now we no longer have CAF
telemetry. We indicate we're running under test to get reliable ordering in the
baselined output.
2024-07-11 12:13:05 -07:00
Christian Kreibich
b387da3489 Revert "Temporarily disable the scripts/base/frameworks/telemetry/internal-metrics btest"
This reverts commit d6e97ab306.
Broker's telemetry is now available again.
2024-07-11 12:13:05 -07:00
Dominik Charousset
40e1e43c25 Bump Broker to pull in new Prometheus support and pass in Zeek's registry
Co-authored-by: Christian Kreibich <christian@corelight.com>
2024-07-11 12:13:05 -07:00
zeek-bot
e99b94c18f Update doc submodule [nomail] [skip ci] 2024-07-11 00:10:52 +00:00
Tim Wojtulewicz
3f475ebf7d Bump cmake submodule [nomail] 2024-07-10 12:37:21 -07:00
Arne Welzel
a9c4daaa22 Merge remote-tracking branch 'jgras/topic/jgras/log-disable-analyzer'
* jgras/topic/jgras/log-disable-analyzer:
  Extend btest for logging of disabled analyzers
  Add logging of disabled analyzers to analyzer.log
2024-07-10 18:51:26 +02:00
Arne Welzel
1c8fedaf09 Merge remote-tracking branch 'origin/topic/awelzel/move-hilti-jit-parallelism-to-btest-cfg'
* origin/topic/awelzel/move-hilti-jit-parallelism-to-btest-cfg:
  testing/btest: Default to HILTI_JIT_PARALLELISM=1
  Revert "CI: Use ccache and a single CPU when building spicy analyzers for btests"
2024-07-10 11:06:46 +02:00
Arne Welzel
7b99fc01a9 testing/btest: Default to HILTI_JIT_PARALLELISM=1
This is a rework of b59bed9d06 moving
HILTI_JIT_PARALLELISM=1 into btest.cfg to make it default applicable to
btest -j users (and CI).

The background for this change is that spicyz may spawn up to nproc compiler
instances by default. Combined with btest -j, this may be nproc x nproc
instances worst case. Particularly with gcc, this easily overloads CI or
local systems, putting them into hard-to-recover-from thrashing/OOM states.

Exporting HILTI_JIT_PARALLELISM in the shell allows overriding.
2024-07-10 11:04:47 +02:00
Arne Welzel
cb500536ea Revert "CI: Use ccache and a single CPU when building spicy analyzers for btests"
This reverts commit b59bed9d06.
2024-07-10 10:02:53 +02:00
zeek-bot
b995924b21 Update doc submodule [nomail] [skip ci] 2024-07-10 00:21:07 +00:00
Tim Wojtulewicz
b309c423f8 Merge remote-tracking branch 'origin/topic/timw/ci-reduce-spicy-test-load'
* origin/topic/timw/ci-reduce-spicy-test-load:
  CI: Use ccache and a single CPU when building spicy analyzers for btests
2024-07-09 15:12:29 -07:00
Tim Wojtulewicz
b64f0e8fd8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-09 14:53:49 -07:00
Tim Wojtulewicz
b59bed9d06 CI: Use ccache and a single CPU when building spicy analyzers for btests 2024-07-09 14:31:09 -07:00
Jan Grashoefer
c6c8d078c0 Extend btest for logging of disabled analyzers 2024-07-09 20:15:46 +02:00
Tim Wojtulewicz
c557b2156a Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Jul24'
* origin/topic/vern/script-opt-maint.Jul24:
  minor script optimization updates to reflect recent changes, Coverity findings
2024-07-09 10:15:26 -07:00
Tim Wojtulewicz
03e17a530a Update zeek-aux submodule [nomail] 2024-07-09 09:33:29 -07:00
Jan Grashoefer
0c06c604ab Add logging of disabled analyzers to analyzer.log 2024-07-09 18:22:43 +02:00
Benjamin Bannier
fcded0fc6a Bump auxil/spicy to latest development snapshot 2024-07-09 18:22:21 +02:00
Arne Welzel
e102715bc8 Merge remote-tracking branch 'cknill/topic/cknill/display_cmake_fix'
* cknill/topic/cknill/display_cmake_fix:
  Fix for --display-cmake in configure Moved build directory creation further down in the script so that --display-cmake has a chance to happen before build tree setup.
2024-07-09 17:10:28 +02:00
Christian Kreibich
6552c4e0fe Merge branch 'topic/christian/management-telemetry-additions'
* topic/christian/management-telemetry-additions:
  Management framework: bump cluster testsuite to pull in telemetry tests
  Management framework: bump zeek-client
  Management framework: augment deployed configs with instance IP addresses
  Management framework: add auto-enumeration of metrics ports
  Management framework: propagate metrics port from agent
  Management framework: add metrics port in management & Supervisor node records
  Harden the telemetry manager against unset Telemetry::metrics_address
  Comment-only tweaks for telemetry-related settings.
2024-07-09 00:08:28 -07:00
Christian Kreibich
cdd5062f45 Management framework: bump cluster testsuite to pull in telemetry tests 2024-07-08 23:05:24 -07:00
Christian Kreibich
7d802f27b7 Management framework: bump zeek-client 2024-07-08 23:05:24 -07:00
Christian Kreibich
8a4fb0ee19 Management framework: augment deployed configs with instance IP addresses
The controller learns IP addresses from agents that peer with it, but that
information has so far gotten lost when resulting configs get pushed out to the
agents. This makes these updates include that information.
2024-07-08 23:05:24 -07:00
Christian Kreibich
742f7fe340 Management framework: add auto-enumeration of metrics ports
This is quite redundant with the enumeration for Broker ports,
unfortunately. But the logic is subtly different: all nodes obtain a telemetry
port, while not all nodes require a Broker port, for example, and in the metrics
port assignment we also cross-check selected Broker ports. I found more unified
code actually harder to read in the end.

The logic for the two sets remains the same: from a start point, ports get
enumerated sequentially that aren't otherwise taken. These ports are assumed
available; there's nothing that checks their availability -- for now.

The default start port is 9000. I considered 9090, to align with the Prometheus
default, but counting upward from there is likely to hit trouble with the Broker
default ports (9999/9997), used by the Supervisor. Counting downward is a bit
unnatural, and shifting the Broker default ports brings subtle ordering issues.

This also changes the node ordering logic slightly since it seems more intuitive
to keep sequential ports on a given instance, instead of striping across them.
2024-07-08 23:05:24 -07:00
Christian Kreibich
fa6361af56 Management framework: propagate metrics port from agent
This propagates the metrics port from the node config passed through the
supervisor all the way into the script layer.
2024-07-08 23:05:24 -07:00